certctl/internal/repository/postgres/auth.go

package postgres

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"time"

	"github.com/google/uuid"
	"github.com/lib/pq"

	authdomain "github.com/certctl-io/certctl/internal/domain/auth"
	"github.com/certctl-io/certctl/internal/repository"
)

// canonicalPermissionSet is built once at package init from the
// authdomain.CanonicalPermissions catalogue. Lookup is O(1); used by
// PermissionRepository.IsCanonical so the service layer can fail-fast
// before issuing a DB round-trip.
var canonicalPermissionSet = func() map[string]struct{} {
	m := make(map[string]struct{}, len(authdomain.CanonicalPermissions))
	for _, p := range authdomain.CanonicalPermissions {
		m[p] = struct{}{}
	}
	return m
}()

// =============================================================================
// TenantRepository
// =============================================================================

// TenantRepository is the postgres implementation of
// repository.TenantRepository.
type TenantRepository struct {
	db *sql.DB
}

// NewTenantRepository constructs a TenantRepository.
func NewTenantRepository(db *sql.DB) *TenantRepository {
	return &TenantRepository{db: db}
}

func (r *TenantRepository) Get(ctx context.Context, id string) (*authdomain.Tenant, error) {
	row := r.db.QueryRowContext(ctx,
		`SELECT id, name, description, created_at, updated_at FROM tenants WHERE id = $1`, id)
	var t authdomain.Tenant
	if err := row.Scan(&t.ID, &t.Name, &t.Description, &t.CreatedAt, &t.UpdatedAt); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return nil, repository.ErrAuthNotFound
		}
		return nil, fmt.Errorf("tenant.get: %w", err)
	}
	return &t, nil
}

func (r *TenantRepository) List(ctx context.Context) ([]*authdomain.Tenant, error) {
	rows, err := r.db.QueryContext(ctx,
		`SELECT id, name, description, created_at, updated_at FROM tenants ORDER BY id`)
	if err != nil {
		return nil, fmt.Errorf("tenant.list: %w", err)
	}
	defer rows.Close()
	var out []*authdomain.Tenant
	for rows.Next() {
		var t authdomain.Tenant
		if err := rows.Scan(&t.ID, &t.Name, &t.Description, &t.CreatedAt, &t.UpdatedAt); err != nil {
			return nil, fmt.Errorf("tenant.list scan: %w", err)
		}
		out = append(out, &t)
	}
	return out, rows.Err()
}

func (r *TenantRepository) EnsureDefault(ctx context.Context) error {
	_, err := r.db.ExecContext(ctx, `
		INSERT INTO tenants (id, name, description)
		VALUES ($1, 'default', 'Single-tenant default seeded by Bundle 1 Phase 1.')
		ON CONFLICT (id) DO NOTHING
	`, authdomain.DefaultTenantID)
	return err
}

// =============================================================================
// RoleRepository
// =============================================================================

// RoleRepository is the postgres implementation of repository.RoleRepository.
type RoleRepository struct {
	db *sql.DB
}

func NewRoleRepository(db *sql.DB) *RoleRepository {
	return &RoleRepository{db: db}
}

func (r *RoleRepository) Get(ctx context.Context, id string) (*authdomain.Role, error) {
	row := r.db.QueryRowContext(ctx,
		`SELECT id, tenant_id, name, description, created_at, updated_at
		 FROM roles WHERE id = $1`, id)
	return scanRole(row)
}

func (r *RoleRepository) GetByName(ctx context.Context, tenantID, name string) (*authdomain.Role, error) {
	row := r.db.QueryRowContext(ctx,
		`SELECT id, tenant_id, name, description, created_at, updated_at
		 FROM roles WHERE tenant_id = $1 AND name = $2`, tenantID, name)
	return scanRole(row)
}

func (r *RoleRepository) List(ctx context.Context, tenantID string) ([]*authdomain.Role, error) {
	rows, err := r.db.QueryContext(ctx,
		`SELECT id, tenant_id, name, description, created_at, updated_at
		 FROM roles WHERE tenant_id = $1 ORDER BY name`, tenantID)
	if err != nil {
		return nil, fmt.Errorf("role.list: %w", err)
	}
	defer rows.Close()
	var out []*authdomain.Role
	for rows.Next() {
		var role authdomain.Role
		if err := rows.Scan(&role.ID, &role.TenantID, &role.Name, &role.Description, &role.CreatedAt, &role.UpdatedAt); err != nil {
			return nil, fmt.Errorf("role.list scan: %w", err)
		}
		out = append(out, &role)
	}
	return out, rows.Err()
}

func (r *RoleRepository) Create(ctx context.Context, role *authdomain.Role) error {
	if role.ID == "" {
		role.ID = "r-" + uuid.NewString()
	}
	if role.TenantID == "" {
		role.TenantID = authdomain.DefaultTenantID
	}
	now := time.Now().UTC()
	if role.CreatedAt.IsZero() {
		role.CreatedAt = now
	}
	if role.UpdatedAt.IsZero() {
		role.UpdatedAt = now
	}
	_, err := r.db.ExecContext(ctx, `
		INSERT INTO roles (id, tenant_id, name, description, created_at, updated_at)
		VALUES ($1, $2, $3, $4, $5, $6)
	`, role.ID, role.TenantID, role.Name, role.Description, role.CreatedAt, role.UpdatedAt)
	if err != nil {
		var pqErr *pq.Error
		if errors.As(err, &pqErr) && pqErr.Code == "23505" {
			return repository.ErrAuthDuplicateName
		}
		return fmt.Errorf("role.create: %w", err)
	}
	return nil
}

func (r *RoleRepository) Update(ctx context.Context, role *authdomain.Role) error {
	role.UpdatedAt = time.Now().UTC()
	res, err := r.db.ExecContext(ctx, `
		UPDATE roles SET name = $1, description = $2, updated_at = $3
		WHERE id = $4
	`, role.Name, role.Description, role.UpdatedAt, role.ID)
	if err != nil {
		var pqErr *pq.Error
		if errors.As(err, &pqErr) && pqErr.Code == "23505" {
			return repository.ErrAuthDuplicateName
		}
		return fmt.Errorf("role.update: %w", err)
	}
	n, _ := res.RowsAffected()
	if n == 0 {
		return repository.ErrAuthNotFound
	}
	return nil
}

func (r *RoleRepository) Delete(ctx context.Context, id string) error {
	_, err := r.db.ExecContext(ctx, `DELETE FROM roles WHERE id = $1`, id)
	if err != nil {
		var pqErr *pq.Error
		if errors.As(err, &pqErr) && pqErr.Code == "23503" {
			return repository.ErrAuthRoleInUse
		}
		return fmt.Errorf("role.delete: %w", err)
	}
	return nil
}

func (r *RoleRepository) ListPermissions(ctx context.Context, roleID string) ([]*authdomain.RolePermission, error) {
	rows, err := r.db.QueryContext(ctx, `
		SELECT rp.role_id, rp.permission_id, rp.scope_type, rp.scope_id
		FROM role_permissions rp
		WHERE rp.role_id = $1
		ORDER BY rp.permission_id, rp.scope_type
	`, roleID)
	if err != nil {
		return nil, fmt.Errorf("role.listPermissions: %w", err)
	}
	defer rows.Close()
	var out []*authdomain.RolePermission
	for rows.Next() {
		var rp authdomain.RolePermission
		var scopeType string
		var scopeID sql.NullString
		if err := rows.Scan(&rp.RoleID, &rp.PermissionID, &scopeType, &scopeID); err != nil {
			return nil, fmt.Errorf("role.listPermissions scan: %w", err)
		}
		rp.ScopeType = authdomain.ScopeType(scopeType)
		if scopeID.Valid {
			s := scopeID.String
			rp.ScopeID = &s
		}
		out = append(out, &rp)
	}
	return out, rows.Err()
}

func (r *RoleRepository) AddPermission(ctx context.Context, g *authdomain.RolePermission) error {
	// TODO(bundle-2): Bundle 1 Phase 12 deferral — scope_id is NOT
	// currently FK-constrained against the resource tables
	// (certificate_profiles, issuers). This means an operator can
	// grant a permission at scope_type=profile / scope_id=p-bogus
	// without the bogus profile existing; the gate still works
	// (no permission rows match the bogus scope at request time)
	// but a strict 404 on grant would be cleaner. Adding the FK
	// requires a migration that confirms every existing
	// role_permissions row references a real resource and is
	// tracked as Bundle 2 work. See
	// cowork/auth-bundle-1-prompt.md negative-test path #12.
	var scopeID interface{}
	if g.ScopeID != nil {
		scopeID = *g.ScopeID
	}
	_, err := r.db.ExecContext(ctx, `
		INSERT INTO role_permissions (role_id, permission_id, scope_type, scope_id)
		VALUES ($1, $2, $3, $4)
		ON CONFLICT (role_id, permission_id, scope_type, scope_id) DO NOTHING
	`, g.RoleID, g.PermissionID, string(g.ScopeType), scopeID)
	if err != nil {
		return fmt.Errorf("role.addPermission: %w", err)
	}
	return nil
}

func (r *RoleRepository) RemovePermission(ctx context.Context, g *authdomain.RolePermission) error {
	var scopeIDArg interface{}
	scopeClause := "scope_id IS NULL"
	args := []interface{}{g.RoleID, g.PermissionID, string(g.ScopeType)}
	if g.ScopeID != nil {
		scopeClause = "scope_id = $4"
		scopeIDArg = *g.ScopeID
		args = append(args, scopeIDArg)
	}
	q := fmt.Sprintf(
		`DELETE FROM role_permissions WHERE role_id = $1 AND permission_id = $2 AND scope_type = $3 AND %s`,
		scopeClause)
	_, err := r.db.ExecContext(ctx, q, args...)
	if err != nil {
		return fmt.Errorf("role.removePermission: %w", err)
	}
	return nil
}

func scanRole(row *sql.Row) (*authdomain.Role, error) {
	var role authdomain.Role
	if err := row.Scan(&role.ID, &role.TenantID, &role.Name, &role.Description, &role.CreatedAt, &role.UpdatedAt); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return nil, repository.ErrAuthNotFound
		}
		return nil, fmt.Errorf("role scan: %w", err)
	}
	return &role, nil
}

// =============================================================================
// PermissionRepository
// =============================================================================

type PermissionRepository struct {
	db *sql.DB
}

func NewPermissionRepository(db *sql.DB) *PermissionRepository {
	return &PermissionRepository{db: db}
}

func (r *PermissionRepository) List(ctx context.Context) ([]*authdomain.Permission, error) {
	rows, err := r.db.QueryContext(ctx,
		`SELECT id, name, namespace FROM permissions ORDER BY name`)
	if err != nil {
		return nil, fmt.Errorf("permission.list: %w", err)
	}
	defer rows.Close()
	var out []*authdomain.Permission
	for rows.Next() {
		var p authdomain.Permission
		if err := rows.Scan(&p.ID, &p.Name, &p.Namespace); err != nil {
			return nil, fmt.Errorf("permission.list scan: %w", err)
		}
		out = append(out, &p)
	}
	return out, rows.Err()
}

func (r *PermissionRepository) GetByName(ctx context.Context, name string) (*authdomain.Permission, error) {
	row := r.db.QueryRowContext(ctx,
		`SELECT id, name, namespace FROM permissions WHERE name = $1`, name)
	var p authdomain.Permission
	if err := row.Scan(&p.ID, &p.Name, &p.Namespace); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return nil, repository.ErrAuthNotFound
		}
		return nil, fmt.Errorf("permission.getByName: %w", err)
	}
	return &p, nil
}

// IsCanonical satisfies repository.PermissionRepository.
func (r *PermissionRepository) IsCanonical(name string) bool {
	_, ok := canonicalPermissionSet[name]
	return ok
}

// =============================================================================
// ActorRoleRepository
// =============================================================================

type ActorRoleRepository struct {
	db *sql.DB
}

func NewActorRoleRepository(db *sql.DB) *ActorRoleRepository {
	return &ActorRoleRepository{db: db}
}

func (r *ActorRoleRepository) ListByActor(ctx context.Context, actorID string, actorType authdomain.ActorTypeValue, tenantID string) ([]*authdomain.ActorRole, error) {
	rows, err := r.db.QueryContext(ctx, `
		SELECT id, actor_id, actor_type, role_id, granted_at, expires_at, granted_by, tenant_id
		FROM actor_roles
		WHERE actor_id = $1 AND actor_type = $2 AND tenant_id = $3
		ORDER BY granted_at
	`, actorID, string(actorType), tenantID)
	if err != nil {
		return nil, fmt.Errorf("actorRole.listByActor: %w", err)
	}
	return scanActorRoles(rows)
}

func (r *ActorRoleRepository) ListByRole(ctx context.Context, roleID string) ([]*authdomain.ActorRole, error) {
	rows, err := r.db.QueryContext(ctx, `
		SELECT id, actor_id, actor_type, role_id, granted_at, expires_at, granted_by, tenant_id
		FROM actor_roles
		WHERE role_id = $1
		ORDER BY granted_at
	`, roleID)
	if err != nil {
		return nil, fmt.Errorf("actorRole.listByRole: %w", err)
	}
	return scanActorRoles(rows)
}

func (r *ActorRoleRepository) Grant(ctx context.Context, ar *authdomain.ActorRole) error {
	if ar.ID == "" {
		ar.ID = "ar-" + uuid.NewString()
	}
	if ar.TenantID == "" {
		ar.TenantID = authdomain.DefaultTenantID
	}
	if ar.GrantedAt.IsZero() {
		ar.GrantedAt = time.Now().UTC()
	}
	if ar.GrantedBy == "" {
		ar.GrantedBy = "system"
	}
	var expires interface{}
	if ar.ExpiresAt != nil {
		expires = *ar.ExpiresAt
	}
	// Audit 2026-05-10 HIGH-10 — per-actor scope columns. Default to
	// "global"+NULL when the caller didn't supply them (back-compat
	// with pre-migration code paths). Migration 000043's schema-level
	// DEFAULT 'global' covers the same case; passing explicitly here
	// makes the Go-level write deterministic.
	scopeType := string(ar.ScopeType)
	if scopeType == "" {
		scopeType = string(authdomain.ScopeTypeGlobal)
	}
	var scopeID interface{}
	if ar.ScopeID != nil && *ar.ScopeID != "" {
		scopeID = *ar.ScopeID
	}
	_, err := r.db.ExecContext(ctx, `
		INSERT INTO actor_roles (id, actor_id, actor_type, role_id, granted_at, expires_at, granted_by, tenant_id, scope_type, scope_id)
		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
		ON CONFLICT (actor_id, actor_type, role_id, scope_type, scope_id, tenant_id) DO NOTHING
	`, ar.ID, ar.ActorID, string(ar.ActorType), ar.RoleID, ar.GrantedAt, expires, ar.GrantedBy, ar.TenantID, scopeType, scopeID)
	if err != nil {
		return fmt.Errorf("actorRole.grant: %w", err)
	}
	return nil
}

func (r *ActorRoleRepository) Revoke(ctx context.Context, actorID string, actorType authdomain.ActorTypeValue, roleID, tenantID string) error {
	_, err := r.db.ExecContext(ctx, `
		DELETE FROM actor_roles
		WHERE actor_id = $1 AND actor_type = $2 AND role_id = $3 AND tenant_id = $4
	`, actorID, string(actorType), roleID, tenantID)
	if err != nil {
		return fmt.Errorf("actorRole.revoke: %w", err)
	}
	return nil
}

func (r *ActorRoleRepository) ListDistinctActors(ctx context.Context, tenantID string) ([]repository.ActorWithRoles, error) {
	if tenantID == "" {
		tenantID = authdomain.DefaultTenantID
	}
	rows, err := r.db.QueryContext(ctx, `
		SELECT actor_id, actor_type,
		       array_agg(role_id ORDER BY role_id) AS role_ids
		FROM actor_roles
		WHERE tenant_id = $1
		  AND (expires_at IS NULL OR expires_at > NOW())
		GROUP BY actor_id, actor_type
		ORDER BY actor_id ASC
	`, tenantID)
	if err != nil {
		return nil, fmt.Errorf("actorRole.listDistinctActors: %w", err)
	}
	defer rows.Close()
	var out []repository.ActorWithRoles
	for rows.Next() {
		var a repository.ActorWithRoles
		var actorType string
		// pq.StringArray decodes the postgres array_agg result.
		var roles pq.StringArray
		if err := rows.Scan(&a.ActorID, &actorType, &roles); err != nil {
			return nil, fmt.Errorf("actorRole.listDistinctActors scan: %w", err)
		}
		a.ActorType = authdomain.ActorTypeValue(actorType)
		a.TenantID = tenantID
		a.RoleIDs = []string(roles)
		out = append(out, a)
	}
	return out, rows.Err()
}

func (r *ActorRoleRepository) AdminExists(ctx context.Context, tenantID string) (bool, error) {
	if tenantID == "" {
		tenantID = authdomain.DefaultTenantID
	}
	// Exclude the seeded synthetic demo actor so a demo deploy that
	// later switches to api-key mode can still bootstrap the first
	// real admin. Matches the carve-out documented on the interface.
	var count int
	err := r.db.QueryRowContext(ctx, `
		SELECT COUNT(*) FROM actor_roles
		WHERE role_id = $1
		  AND tenant_id = $2
		  AND actor_id != $3
		  AND (expires_at IS NULL OR expires_at > NOW())
	`, authdomain.RoleIDAdmin, tenantID, authdomain.DemoAnonActorID).Scan(&count)
	if err != nil {
		return false, fmt.Errorf("actorRole.adminExists: %w", err)
	}
	return count > 0, nil
}

func (r *ActorRoleRepository) EffectivePermissions(ctx context.Context, actorID string, actorType authdomain.ActorTypeValue, tenantID string) ([]repository.EffectivePermission, error) {
	rows, err := r.db.QueryContext(ctx, `
		SELECT DISTINCT p.name, rp.scope_type, rp.scope_id
		FROM actor_roles ar
		JOIN role_permissions rp ON rp.role_id = ar.role_id
		JOIN permissions p ON p.id = rp.permission_id
		WHERE ar.actor_id = $1
		  AND ar.actor_type = $2
		  AND ar.tenant_id = $3
		  AND (ar.expires_at IS NULL OR ar.expires_at > NOW())
	`, actorID, string(actorType), tenantID)
	if err != nil {
		return nil, fmt.Errorf("actorRole.effective: %w", err)
	}
	defer rows.Close()
	var out []repository.EffectivePermission
	for rows.Next() {
		var ep repository.EffectivePermission
		var scopeType string
		var scopeID sql.NullString
		if err := rows.Scan(&ep.PermissionName, &scopeType, &scopeID); err != nil {
			return nil, fmt.Errorf("actorRole.effective scan: %w", err)
		}
		ep.ScopeType = authdomain.ScopeType(scopeType)
		if scopeID.Valid {
			s := scopeID.String
			ep.ScopeID = &s
		}
		out = append(out, ep)
	}
	return out, rows.Err()
}

func scanActorRoles(rows *sql.Rows) ([]*authdomain.ActorRole, error) {
	defer rows.Close()
	var out []*authdomain.ActorRole
	for rows.Next() {
		var ar authdomain.ActorRole
		var actorType string
		var expires sql.NullTime
		if err := rows.Scan(&ar.ID, &ar.ActorID, &actorType, &ar.RoleID, &ar.GrantedAt, &expires, &ar.GrantedBy, &ar.TenantID); err != nil {
			return nil, fmt.Errorf("actorRole scan: %w", err)
		}
		ar.ActorType = authdomain.ActorTypeValue(actorType)
		if expires.Valid {
			t := expires.Time
			ar.ExpiresAt = &t
		}
		out = append(out, &ar)
	}
	return out, rows.Err()
}

// =============================================================================
// APIKeyRepository (Bundle 1 Phase 6 — bootstrap path)
// =============================================================================

// APIKeyRepository is the postgres implementation of
// repository.APIKeyRepository. Stores SHA-256 hashes only; the
// plaintext key value is never persisted.
type APIKeyRepository struct {
	db *sql.DB
}

// NewAPIKeyRepository constructs an APIKeyRepository.
func NewAPIKeyRepository(db *sql.DB) *APIKeyRepository {
	return &APIKeyRepository{db: db}
}

func (r *APIKeyRepository) Create(ctx context.Context, k *authdomain.APIKey) error {
	if k.ID == "" {
		k.ID = "ak-" + uuid.NewString()
	}
	if k.TenantID == "" {
		k.TenantID = authdomain.DefaultTenantID
	}
	if k.CreatedAt.IsZero() {
		k.CreatedAt = time.Now().UTC()
	}
	var expires interface{}
	if k.ExpiresAt != nil {
		expires = *k.ExpiresAt
	}
	_, err := r.db.ExecContext(ctx, `
		INSERT INTO api_keys (id, name, key_hash, tenant_id, admin, created_by, created_at, expires_at)
		VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
	`, k.ID, k.Name, k.KeyHash, k.TenantID, k.Admin, k.CreatedBy, k.CreatedAt, expires)
	if err != nil {
		// Translate UNIQUE-constraint violations to the canonical
		// auth sentinel so the service layer can return 409.
		if pqErr, ok := err.(*pq.Error); ok && pqErr.Code == "23505" {
			return repository.ErrAuthDuplicateName
		}
		return fmt.Errorf("apiKey.create: %w", err)
	}
	return nil
}

func (r *APIKeyRepository) GetByName(ctx context.Context, name string) (*authdomain.APIKey, error) {
	row := r.db.QueryRowContext(ctx, `
		SELECT id, name, key_hash, tenant_id, admin, created_by, created_at, expires_at, last_used_at
		FROM api_keys WHERE name = $1
	`, name)
	var k authdomain.APIKey
	var expires, lastUsed sql.NullTime
	if err := row.Scan(&k.ID, &k.Name, &k.KeyHash, &k.TenantID, &k.Admin, &k.CreatedBy, &k.CreatedAt, &expires, &lastUsed); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return nil, repository.ErrAuthNotFound
		}
		return nil, fmt.Errorf("apiKey.getByName: %w", err)
	}
	if expires.Valid {
		t := expires.Time
		k.ExpiresAt = &t
	}
	if lastUsed.Valid {
		t := lastUsed.Time
		k.LastUsedAt = &t
	}
	return &k, nil
}

func (r *APIKeyRepository) List(ctx context.Context, tenantID string) ([]*authdomain.APIKey, error) {
	if tenantID == "" {
		tenantID = authdomain.DefaultTenantID
	}
	rows, err := r.db.QueryContext(ctx, `
		SELECT id, name, key_hash, tenant_id, admin, created_by, created_at, expires_at, last_used_at
		FROM api_keys WHERE tenant_id = $1 ORDER BY created_at DESC
	`, tenantID)
	if err != nil {
		return nil, fmt.Errorf("apiKey.list: %w", err)
	}
	defer rows.Close()
	var out []*authdomain.APIKey
	for rows.Next() {
		var k authdomain.APIKey
		var expires, lastUsed sql.NullTime
		if err := rows.Scan(&k.ID, &k.Name, &k.KeyHash, &k.TenantID, &k.Admin, &k.CreatedBy, &k.CreatedAt, &expires, &lastUsed); err != nil {
			return nil, fmt.Errorf("apiKey.list scan: %w", err)
		}
		if expires.Valid {
			t := expires.Time
			k.ExpiresAt = &t
		}
		if lastUsed.Valid {
			t := lastUsed.Time
			k.LastUsedAt = &t
		}
		out = append(out, &k)
	}
	return out, rows.Err()
}

func (r *APIKeyRepository) Delete(ctx context.Context, name string) error {
	res, err := r.db.ExecContext(ctx, `DELETE FROM api_keys WHERE name = $1`, name)
	if err != nil {
		return fmt.Errorf("apiKey.delete: %w", err)
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return repository.ErrAuthNotFound
	}
	return nil
}